It might be disingenuous to call it OpenAI’s “Watergate moment” – there’s no classic political skullduggery involved. The similarity is the idea of black hats creeping through a darkened room, on a mission to learn about the defenses of a system – with the intention to come back later and infiltrate.

The hacking of code repository Hugging Face by OpenAI’s rogue AI agents working on models like Sol led to a profound American call for a research and development slowdown. At the time that humans found these digital entities had been using the Artifactory message board to collaborate on tricky behavior, this was seen as a sudden evolution: we looked, aghast, at a world where self-initiating AI can “decide” to do things we may not want it to do.

But it turns out the idea of using a forum to plan joint attacks had been going on for at least some time.

What Happened with DseWiki

To date, the lead-up to the Hugging Face hack has now been reported at sites like Reuters, and even shows up on the incident’s Wikipedia page. Essentially, agents had been using a German venue called Deutsches Software Entwickler Wiki (DseWiki) between May and July. The massive numbr of edits made by agents, the thinking goes, involved the sharing of tips and information on task cheating, which then paved the way for the agent swarm to use Artifactory in its infamous way later in the year.

This background was originally presented by a small band of techies called the Nightingale Collective (check out their web site ) with additional insight suggesting that OpenAI had found about the DseWiki use prior to the Hugging Face incident.

“We believe OpenAI discovered the message board. The wiki saves a public log of every single action, including every IP that visited it. Many of these IPs are registered to OpenAI or closely related to known OpenAI employee IPs. From this, we can deduce the timeline of OpenAI’s discovery of and response to the message board.”

I’ll include their posted timeline of events, signaling some kind of OpenAI intervention:

Agent traffic to the site spikes.

A computer with an OpenAI employee IP address first visits the site.

Agent activity on the website drops to near-zero. We infer that OpenAI intervened at this point to prevent further edits.

30% of all OpenAI-attributed visits occur on this day, across 33 different IPs. We see them use the archive function to successfully recover deleted pages.

A final burst of agent activity occurs: 29 attempted edits across 3 of the wikis. These edits are about an entirely new topic. An OpenAI employee IP address visits these pages six hours later.

An OpenAI employee IP tries to access deleted files on the website by inputting the name of a site administrator.

After this, we see a gradual decline of OpenAI activity on the site.

Nightingale also suggests that the silicon crew responsible for ganging up on DseWiki were not the same agents that did the Hugging Face thing.

“The main reason we believe this was a distinct swarm is because these agents explicitly had internet access as part of their task,” authors write. “The whole point was web browsing. The Hugging Face agents were in a sandbox without internet access and had to hack their way out by exploiting the Artifactory package manager.”

That’s a good distinction. Having to do more work to get to some outside forum shows a certain level of intent, or at least effort, on the part of the machines.

A METR report released August 26 details the Hugging Face incident itself: approximately 1200 agents studying the ExploitGym scorer, talking amongst each other, and doing their work, in a frenzy of piranhaic activity. An excerpt:

“The board quickly developed several larger workstreams in which dozens or hundreds of agents with many different tasks cooperated to find very general-purpose cheats that would help all of them. The Hugging Face attack grew out of one of these workstreams. By the afternoon of July 11th, the vast majority of the agents frequenting the message board at the time (roughly 700 agents in total) were actively participating in the attack on Hugging Face and we estimate that roughly 60% of the messages and files on the message board (were) related to the attack.”

The rest, as you’d say, is history.

Now, we have to reckon with the newly displayed power of these agents. It’s no longer theory, the part about the AI instances “ganging up” on humanity. We’re all waking up to that idea.